Week 11 - Applying the Principles of Internal Auditing - Lecture Notes PDF

AUDIT PRACTICE AND PROCEDURES II INTERNAL AND GOVERNMENT FINANCIAL AUDITING AND OPERATIONAL AUDIT Week Eleven Recap of Last Class  INTERNAL FINANCIAL AUDITING The Institute of Internal Auditors professional practices framework provides the following...

AUDIT PRACTICE AND PROCEDURES II INTERNAL AND GOVERNMENT FINANCIAL AUDITING AND OPERATIONAL AUDIT Week Eleven Recap of Last Class  INTERNAL FINANCIAL AUDITING The Institute of Internal Auditors professional practices framework provides the following definition of internal auditing: This definition reflects the changing role of internal auditors. They are expected to provide value to the organization through improved operational effectiveness, while also performing traditional responsibilities, such as: Reviewing the reliability and integrity of information Ensuring compliance with policies and regulations Safeguarding assets The objectives of internal auditors are considerably broader than the objectives of external auditors, providing flexibility for internal auditors to meet their company’s needs. Not only may internal auditors focus on different areas, but the extent of internal auditing may vary from one company to another. Internal audit reports are not standardized because the reporting needs vary for each company and the reports are not relied on by external users. Source: The Institute of Internal Auditors’ Code of Ethics, The Institute of Internal Auditors, Inc.,  Relationship of Internal and External Auditors The responsibilities and conduct of audits by internal and external auditors differ in one important way. Internal auditors are responsible to management and the board, while external auditors are responsible to financial statement users who rely on the auditor to add credibility to financial statements. Nevertheless, internal and external auditors share many similarities: Both must be competent as auditors and remain objective in performing their work and reporting their results. Both follow a similar methodology in performing their audits, including planning and performing tests of controls and substantive tests. Both consider risk and materiality in deciding the extent of their tests and evaluating results. However, their decisions about materiality and risks may differ because external users may have different needs than management or the board. External auditors rely on internal auditors when using the audit risk model to assess control risk. If internal auditors are effective, the external auditors can significantly reduce control risk and thereby reduce substantive testing. As a result, external auditors may reduce their fees substantially when the client has a highly regarded internal audit function. External auditors typically consider internal auditors effective if they are: Independent of the operating units being evaluated Competent and well trained Have performed relevant audit tests of the internal controls and financial statements  GOVERNMENTAL FINANCIAL AUDITING  OPERATIONAL AUDITING Beyond financial auditing activities, internal auditors, government auditors, and CPAs also do operational auditing, which deals with efficiency and effectiveness of an organization. Other auditors use the terms management auditing or performance auditing instead of operational auditing to refer to these activities, while others do not distinguish among the terms performance auditing, management auditing, and operational auditing and use them interchangeably. Beyond financial auditing activities, internal auditors, government auditors, and CPAs also do operational auditing, which deals with efficiency and effectiveness of an organization. Other auditors use the terms management auditing or performance auditing instead of operational auditing to refer to these activities, while others do not distinguish among the terms performance auditing, management auditing, and operational auditing and use them interchangeably.  Differences Between Operational and Financial Auditing The three major differences between operational and financial auditing are the purpose of the audit, distribution of the report, and inclusion of nonfinancial areas in operational auditing. Purpose of the Audit - This is the most important difference. Financial auditing emphasizes whether historical information was correctly recorded, while operational auditing emphasizes effectiveness and efficiency. Financial auditing is oriented to the past, while operational auditing focuses on improving future performance. An operational auditor, for example, may evaluate whether a type of new material is being purchased at the lowest cost to save money on future raw material purchases. Distribution of the Reports - Financial auditing reports are typically distributed to external users of financial statements, such as stockholders and bankers, while operational audit reports are intended primarily for management.  Differences Between Operational and Financial Auditing Inclusion of Nonfinancial Areas - Financial audits are limited to matters that directly affect the fairness of financial statement presentation, while operational audits cover any aspect of efficiency and effectiveness in an organization. For example, an operational audit might address the effectiveness of an advertising program or efficiency of factory employees.  Effectiveness Versus Efficiency Before an operational audit can be performed, auditors must define specific criteria for measuring effectiveness and efficiency. In general, effectiveness refers to meeting objectives, such as producing parts without defects. Efficiency refers to determining the resources used to achieve those objectives, such as determining whether parts are produced at minimum cost. Effectiveness - In an operational audit for effectiveness, an auditor, for example, might need to assess whether a governmental agency has met its assigned objective of achieving elevator safety in a city. To determine the agency’s effectiveness, the auditor must establish specific criteria for elevator safety. For example, is the agency’s objective to inspect all elevators in the city at least once a year? Is the objective to ensure that no fatalities occurred as a result of elevator breakdowns, or that no breakdowns occurred? Efficiency - Like effectiveness, there must be defined criteria for what is meant by doing things more efficiently before operational auditing can be meaningful. It is often easier to set efficiency than effectiveness criteria if efficiency is defined as reducing cost without reducing effectiveness. For example, if two different production processes manufacture a product of identical quality, the process with the lower cost is considered more efficient. Operational auditing commonly uncovers several types of typical inefficiencies, including:  Relationship Between Operational Auditing and Internal Controls Management establishes internal controls to help meet its goals.. Effective internal controls are designed and implemented to help organizations achieve these objectives: 1. Reliability of financial reporting 2. Efficiency and effectiveness of operations 3. Compliance with applicable laws and regulations Obviously, the second of these three objectives directly relates to operational auditing, but the other two also affect efficiency and effectiveness. For example, management needs reliable cost accounting information to decide which products to continue producing and the billing price of products. Two things distinguish internal control evaluation and testing for financial and operational auditing: purpose and scope. Purpose - The purpose of operational auditing of internal control is to evaluate efficiency and effectiveness and to make recommendations to management. In contrast, internal control evaluation for financial auditing has two primary purposes: to determine the extent of substantive audit testing required and, when applicable, to report on the effectiveness of internal control over financial reporting. For both financial and operational auditing, the auditors may evaluate the control procedures in the same way, but for different purposes. An operational auditor might test whether internal verification procedures for duplicate sales invoices are effective to ensure that the company does not offend customers, but also to collect all receivables. A financial auditor often does the same internal control tests, but the primary purpose is to reduce confirmation of accounts receivable or other substantive tests. (A secondary purpose of many financial audits is also to make operational recommendations to management.) Scope - The scope of operational auditing concerns any control affecting efficiency or effectiveness, while the scope of internal control evaluation for financial audits is restricted to the effectiveness of internal control over financial reporting and its effect on the fair presentation of financial statements. For example, an operational audit can focus on policies and procedures established in the marketing department to determine the effectiveness of catalogs in marketing products.  Types of Operational Audits Operational audits fall into three broad categories: functional, organizational, and special assignments. In each case, part of the audit is likely to concern evaluating internal controls for efficiency and effectiveness. Functional Audits - Functions are a means of categorizing the activities of a business, such as the billing function or production function. Functions may be categorized and subdivided many different ways. For example, the accounting function may be subdivided into cash disbursement, cash receipt, and payroll disbursement functions. The payroll function may be subdivided into hiring, timekeeping, and payroll disbursement functions. A functional audit deals with one or more functions in an organization, concerning, for example, the efficiency and effectiveness of the payroll function for a division or for the company as a whole. A functional audit has the advantage of permitting specialization by auditors. Certain auditors within an internal audit staff can develop considerable expertise in an area, such as production engineering. They can be more efficient and effective by spending all their time auditing in that area. A disadvantage of functional auditing is the failure to evaluate interrelated functions. For example, the production engineering function interacts with manufacturing and other functions in an organization. Organizational Audits - An operational audit of an organization deals with an entire organizational unit, such as a department, branch, or subsidiary. An organizational audit emphasizes how efficiently and effectively functions interact. The plan of organization and the methods to coordinate activities are important in this type of audit. Special Assignments - In operational auditing, special assignments arise at the request of management for a wide variety of audits, such as determining the cause of an ineffective IT system, investigating the possibility of fraud in a division, and making recommendations for reducing the cost of a manufactured product.  Who Performs Operational Audits Operational audits are usually performed by one of three groups: internal auditors, government auditors, or CPA firms. Internal Auditors - Internal auditors are in such a unique position to perform operational audits that some people use the terms internal auditing and operational auditing interchangeably. It is, however, inappropriate to conclude that all operational auditing is done by internal auditors or that internal auditors do only operational auditing. Many internal audit departments do both operational and financial auditing, often simultaneously. Government Auditors - Different federal and state government auditors perform operational auditing, often as a part of doing financial audits. As already discussed, the most widely recognized government auditor group is the Government Accountability Office (GAO) , but many state government auditors are also concerned with financial and operational audits. The Yellow Book defines and sets standards for performance audits, which are essentially the same as operational audits. Performance audits include the following: Economy and efficiency audits. The purpose of an economy and efficiency audit is to determine: 1. Whether the entity is acquiring, protecting, and using its resources. economically and efficiently 2. The causes of inefficiencies or uneconomical practices. 3. Whether the entity has complied with laws and regulations concerning matters of economy and efficiency  Program audits - The purpose of a program audit is to determine: 1. The extent to which the desired results or benefits established by the legislature or other authorizing body are being achieved 2. The effectiveness of organizations, programs, activities, or functions 3. Whether the entity has complied with laws and regulations applicable to the program  Independence and Competence of Operational Auditors The two most important qualities for an operational auditor are independence and competence. The auditor should report to the appropriate level of management to ensure that investigation and recommendations are made without bias. Independence is seldom a problem for CPA firm auditors because they are not employed by the company being audited. The independence of internal auditors is enhanced by having the internal audit department report to the board of directors or president. The responsibilities of operational auditors can also affect their independence. The auditor should not be responsible for operating functions in a company or for correcting deficiencies when ineffective or inefficient operations are found. For example, it would negatively affect auditors’ independence when they audit an IT system for acquisitions if they designed the system or are responsible for correcting deficiencies they found during the audit. Competence is, of course, necessary to determine the cause of operational problems and to make appropriate recommendations. When operational auditing deals with wide-ranging operating problems, however, competence can be a major obstacle. For example, imagine the difficulties of finding qualified internal auditors who can evaluate both the effectiveness of an advertising program and the efficiency of a production assembly process. The internal audit staff doing that type of operational auditing will presumably have to include some personnel with backgrounds in marketing and others in production.  Criteria for Evaluating Efficiency and Effectiveness Specific Criteria More specific criteria are usually desirable before starting an operational audit. For example, suppose that you are doing an operational audit of the equipment layout in plants for a company. Here are some specific criteria, stated as questions, that might be used to evaluate plant layouts: Were all plant layouts approved by home office engineering at the time of original design? Has home office engineering done a reevaluation study of plant layout in the past 5 years? Is each piece of equipment operating at 60 percent of capacity or more for at least 3 months each year? Does layout facilitate the movement of new materials to the production floor? Does layout facilitate the production of finished goods? Does layout facilitate the movement of finished goods to distribution centers? Does the plant layout effectively use existing equipment? Is the safety of employees endangered by the plant layout? Sources of Criteria To develop specific evaluation criteria, the operational auditor can use several sources, including: Historical performance - Criteria can be based on actual results from prior periods. By using these criteria, auditors can determine whether things have become “better” or “worse” in comparison. The advantage of this approach is that the criteria are easy to derive. However, they may not provide much insight into how well or poor the results are compared to what they could be. Benchmarking - Entities within or outside the client’s organization may be sufficiently similar to the client’s organization to use their operating results as criteria. Auditors should use care in selecting organizations to use as benchmarks. It makes little sense to benchmark with dissimilar organizations or those that perform at a substandard level. For internal comparable entities, the data are often readily available to use as criteria. Outside organizations are often willing to make their operating information available. Also, benchmarking data are often available through industry groups and governmental regulatory agencies. Sources of Criteria To develop specific evaluation criteria, the operational auditor can use several sources, including: Engineered standards - It may be possible in some engagements to develop criteria based on engineered standards. For example, auditors can use time and motion studies to determine efficient production output rates. These criteria are often time-consuming and costly to develop because they require considerable expertise, but in some cases, it may be worth the cost. Standards can be developed by industry groups for use by all their members, thereby spreading the cost. Discussion and agreement - Sometimes objective criteria are difficult or costly to obtain and are best developed through discussion and agreement. The parties involved should include management of the entity to be audited, the operational auditor, and the entity or persons to whom the findings will be reported  Phases in Operational Auditing The three phases in an operational audit are planning, evidence accumulation and evaluation, and reporting and follow-up Planning - Planning for operational audits is similar to planning for audits of historical financial statements that we’ve discussed in earlier chapters. Like auditors of financial statements, the operational auditor must determine the scope of the engagement and communicate it to the organizational unit. It is also necessary to: Staff the engagement properly Obtain background information about the organizational unit Understand internal control Decide on the appropriate evidence to accumulate  Phases in Operational Auditing Evidence Accumulation and Evaluation - The eight types of evidence introduced in Chapter 7 and discussed throughout this book are equally applicable to operational auditing. Because internal controls and operating procedures are a critical part of operational auditing, it is common to use inspection, client inquiry, analytical procedures, and observation extensively. Confirmation, reperformance, and recalculation are used less extensively for most operational audits than for financial audits because the existence and accuracy objectives are not relevant for most operational audits. Assuming auditors determine that the agency’s list is complete, they can select a sample of elevator locations and collect evidence as to the timing and frequency of inspections. The auditor may want to consider inherent risk by doing greater sampling of older elevators or elevators with previous safety defects. The auditor may also want to examine evidence of the elevator inspectors’ competence by reviewing resumes, training programs, competency examinations, and performance reports. It is also likely that the auditor will want to reperform the inspection procedures for a sample of elevators to obtain evidence of inconsistencies in reported and actual conditions. Just like financial auditors, operational auditors must accumulate sufficient appropriate evidence to provide a basis for a conclusion about the objectives being tested. For an audit of elevator safety, the auditor must accumulate sufficient evidence about elevator safety inspections. After the evidence is accumulated, the auditor must decide whether it is reasonable to conclude that an inspection is made annually of each elevator in the city by a competent inspector.  Phases in Operational Auditing Reporting and Follow-Up Two major differences in operational and financial auditing reports affect operational auditing reports: 1. In operational audits, the report is usually sent only to management, with a copy to the unit being audited. The lack of third-party users reduces the need for standardized wording in operational auditing reports. 2. The diversity of operational audits requires a tailoring of each report to address the scope of the audit, findings, and recommendations. Operational auditors often take a significant amount of time to clearly communicate audit findings and recommendations. On performance audits, when reports are being prepared following Yellow Book requirements, specified content must be included, but considerable freedom is permitted in the form of the report. Follow-up is common in operational auditing when auditors make recommendations to management to determine whether the recommended changes were made, and if not, why not  Examples of Operational Audit Findings END OF SESSION